Add proof in ScanState.v